The archive typically contains malicious shortcut (LNK) files that trigger PowerShell scripts to establish persistence and exfiltrate data. How the Attack Works
Phishing emails containing finance-themed ZIP or RAR files. SpaceSeals-DOGE.rar
Infostealer and Ransomware (modified variant of Fog ransomware). SpaceSeals-DOGE.rar
: The malware utilizes a "Bring Your Own Vulnerable Driver" ( BYOVD ) technique, exploiting a known vulnerability ( CVE-2015-2291 ) to gain kernel-level access. SpaceSeals-DOGE.rar
In early 2025, reports surfaced that a software engineer working for both DOGE and the Federal Emergency Management Agency () had his device infected by this or similar infostealer malware, leading to the leak of credentials for core government financial systems.